|
When the source IP address of the NetBIOS broadcast belongs to a different subnet than the FortiGate interface, the FortiGate does not recognize the packets as NetBIOS traffic.
Instead, it classifies them as generic UDP broadcast packets.
In this case, the FortiGate ignores the netbios-forward setting and, if allow-traffic-redirect is enabled in the global settings, it may still forward these broadcasts.
Example configuration:
config system interface
edit "port1"
set netbios-forward disable
next
end
Example output:
FG6H0F-3 # get system status | grep build
Version: FortiGate-600F v7.4.8,build2795,250523 (GA.M)
First GA patch build date: 230509
FG6H0F-3 # show system interface port1
config system interface
edit "port1"
set vdom "root"
set ip 172.27.140.51 255.255.255.0
set allowaccess ping https ssh http telnet fgfm
set type physical
set snmp-index 3
next
end
FG6H0F-3 # get system global | grep redir
admin-https-redirect: enable
allow-traffic-redirect: enable
ipv6-allow-traffic-redirect: enable
FG6H0F-3 # diagnose packet sniffer any 'host 172.27.40.220' 4 0 a
2025-10-23 10:19:11.718055 port1 in 172.27.40.220.137 -> 172.27.40.255.137: udp 30
2025-10-23 10:19:11.718063 port1 out 172.27.40.220.137 -> 172.27.40.255.137: udp 30
2025-10-23 10:19:12.718375 port1 in 172.27.40.220.137 -> 172.27.40.255.137: udp 30
2025-10-23 10:19:12.718382 port1 out 172.27.40.220.137 -> 172.27.40.255.137: udp 30
As shown above, even though the netbios-forward is disabled, the NetBIOS UDP broadcast packets are forwarded out of the same interface because the traffic is redirected under allow-traffic-redirect.
Behavior by FortiOS version:
FortiOS v7.0.16/v7.2.10/v7.4.4 and later:
FortiGate may forward NetBIOS broadcasts when allow-traffic-redirect is enabled and the source IP is from a different subnet.
Earlier FortiOS versions:
When the source IP address is on a different network than the FortiGate interface performing traffic redirection, the traffic must match an IPv4 policy regardless of the allow-traffic-redirect setting.
Workaround:
Disable traffic redirection globally:
config system global
set allow-traffic-redirect disable
end
This issue has been resolved in v8.0.0 (scheduled to be released in March 2026). These timelines for firmware release are estimated and may be subject to change.
Note:
v5.0 up to v7.0 are out of engineering support. So these commands might be different on higher versions. Consider upgrading the firmware level on the device to a supported version (v7.2 up to v7.6). Check the firmware path and compatibility depending on the hardware on the following link: Upgrade tool
Related article:
Technical Tip: Traffic handled by FortiGate for packets with ingress & egress as same interface
|
